CVE-2022-50618

Vulnerability

In the Linux kernel's meson-gx MMC driver, the function mmc_add_host() is called without checking its return value. If this function fails, the error is silently ignored, leading to two distinct issues: a memory leak of the host structure allocated by mmc_mmc_alloc_host(), and a null-pointer dereference in the device removal path when mmc_remove_host()` attempts to delete a device that was never added [1].

Exploitation

An attacker would need to trigger a failure in mmc_add_host(), which could occur due to resource exhaustion or hardware misconfiguration. No special privileges are required beyond the ability to cause the MMC subsystem to initialize a host controller. The vulnerability is local and requires physical or physical access or the ability to manipulate the MMC subsystem state.

Impact

If exploited, the memory leak degrades system stability: the memory leak reduces available memory over time, and the null-pointer dereference in device_del() leads to a kernel crash (denial of service). There is no evidence of privilege escalation or data corruption.

Mitigation

The fix was applied in Linux kernel stable commit 42343e3c6195e934b9cb4c08b7ff84a3778d77f9, which adds a proper return value check and jumps to an error path that calls mmc_free_host() to clean up the allocated memory [1]. Users should update to a kernel version containing this commit.